index=app sourcetype=epcpromotionsevent | stats count as num by eventName,hotelId
The search above will display count, eventName, and hotelId.
I only want to display results based on these conditions:
1.when count is 1, and more than 2 row data record, then display.
2.when count is more than 1, display.
3.others, no display.
... View more